VMware 5V0-91.20 Actual Free Exam Questions & Community Discussion

Exam Code/Number: 5V0-91.20
Exam Name/Title: VMware Carbon Black Portfolio Skills
Certification Provider: VMware
Corresponding Certification: VMware Carbon Black EndPoint Protection 2021

Exam Questions: 115
Updated On: Oct 03, 2026

Question #1

In which two ways can the tamper protection on an App Control agent be disabled when diagnosing agent issues or removing the agent? (Choose two.)

A. Run RepCLI on Windows command prompt

B. From the File Catalog page on the web console

C. From the Files on Computers page on the web console

D. From the Computer Details page on the web console

E. Run authenticated DasCLI on Windows command prompt

Discussion 0

Correct Answer: D,E Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #2

While an administrator is reviewing an alert, the device is observed beaconing to an unknown destination.
Which action should be taken to stop this behavior?

A. Deregister the sensor

B. Place the device in Quarantine

C. Assign the application to the Approved List

D. Put the device in Bypass mode

Discussion 0

Correct Answer: D Vote an answer

Question #3

An administrator is interested in upgrading endpoints to the latest release in VMware Carbon Black App Control (V8.1.4+).
What is the first step to make a new agent available for installation or upgrade?

A. Download from the Carbon Black Cloud Back End

B. Download from the Carbon Black User Exchange

C. Download from the Carbon Black Software Reputation Service (SRS)

D. Download from the Carbon Black App Control Server

Discussion 0

Correct Answer: A Vote an answer

Question #4

A process wrote an executable file as detailed in the following event:

Which rule type should be used to ensure that files of the same name and path, written by that process in the future, will not be blocked when they execute?

A. Advances (Write-Ignore)

B. File Creation Control

C. Trusted Publisher

D. Trusted Path

Discussion 0

Correct Answer: B Vote an answer

Question #5

An administrator observes the following event detail in the Investigate tab for an application with an unknown reputation making network connections:

Upon further review of the event details returned, the reputation is observed as NOT_LISTED, and the applied (cloud) reputation is UNKNOWN.
Why is the applied (cloud) reputation UNKNOWN and not NOT_LISTED?

A. NOT_LISTED was applied by the sensor after observing no cloud reputation, as evidenced by the applied cloud reputation UNKNOWN.

B. The sensor demoted the local reputation from UNKNOWN to NOT_LISTED based on the coud reputation.

C. The application was UNKNOWN at the time of the event but then later determined to be NOT_LISTED.

D. The sensor demoted the local reputation from NOT_LISTED to UNKNOWN based on the cloud reputation.

Discussion 0

Correct Answer: C Vote an answer

Question #6

Which actions are available for Permissions?

A. Deny Operation, Terminate Process

B. Allow, Allow & Log, Bypass

C. Approve, Upload, No Upload

D. Performs any Operation, Runs or is running

Discussion 0

Correct Answer: B Vote an answer

Question #7

How is a new Alert of type Event Alert created whenever an endpoint is added or deleted and send emails for the App Control admin whenever these events occur?

A. Add filter in Event Properties for Subtype Computer added and Computer deleted. Add the App Control admin email, and then click Create & Exit.

B. Add filter in Event Properties for Subtype Computer modified. Add the App Control admin email, and then click Create & Exit.

C. Add filter in Event Properties for Subtype Computer added and Computer deleted. Click Create and add the App Control admin email, and then click Create & Exit.

D. Add filter in Event Properties for Subtype Endpoint added and Endpoint deleted. Click Create and add the App Control admin email, and then click Create &. Exit.

Discussion 0

Correct Answer: B Vote an answer

Question #8

When executing a program in App Control, the notification message informs the user that the file is not approved with an option to request approval.
Which Enforcement level is currently enacted?

A. High

B. Default

C. Low

D. Medium

Discussion 0

Correct Answer: B Vote an answer

Download Free VMware 5V0-91.20 Demo

Simply submit your e-mail address below to get started with our free demo of your VMware 5V0-91.20 exam.